dispatch.earliest_time in Splunk savedsearch.conf - splunk

I am new to splunk, and trying to understand what’s the difference between dispatch.earliest_time = "-15m#m" and dispatch.earliest_time = "-15m”. Thanks!

There is no practical difference. Both begin the search 15 minutes before the current time. The #m portion rounds off the start time to beginning of the minute, but is not necessary since the search scheduler uses minute resolution.

Related

Finding maximum input (time complexity)

Assume a computer operating at 1GHz speeds — i.e. it executes 10^9 instructions/second. For each of the following time complexities, what is the largest size input n that could be completely processed in 1 week?
a) n²
b) n³
c) 2^n
This is homework. I don't need the answer I just don't know how to start the problem. Can someone please show me how to solve the first one. I could then figure out the rest. Thank you!
The way I see it is take 10^9 and subtract 10² to get the maximum input but that seems too easy.
60 seconds in a minute, 60 minutes in an hour, 24 hours in a day, 7 days in a week. That's 604800 seconds.
If you can execute 10^9 instructions per second, you can execute 604800*10^9 instructions per week - that's 6.048*10^14.
The square root of 6.048*10^14 is 24,592,681, i.e. we can process 24,592,681^2 instructions in a week, so we can process 24,592,681 sized input if it is n^2 time complexity.
The rest are pretty similar.

SQL time comparision

I'm trying to show rows which have hour value (24H format) after current time.
Currently I'm using:
where time(hour)>time(now())
but this comparision fails when current time is for example 23:50 and stored value is 00:10.
Is there any way to copmare it correctly?
This is the part of query to show nearest departures of buses on bus stop.
Well, you could try:
where time(hour)>time(now()) or time(hour) = 0
I think it would be better if you check if it's in future first, and then check the difference. As far as I understand, that would works better for your usage:
WHERE time > NOW() and TIMESTAMPDIFF(MINUTE,time,NOW()) < 60

Check for minutes not evenly divided by 5

I have a time stored as a decimal(9,2) column in an sql-server 2005 database.
The time is represented like
Time timeInDecimal
1H 20Min 1.33
1H 30Min 1.50
and so on
I´m looking for an easy way to check whether the number of minutes except whole hours is not evenly divided by 5.
The value I'm hoping to find is where the time is 1H:23Min but not 1H:25MIN.
I just wan´t to compare the minute part of the time.
The way I do now is:
RIGHT(CONVERT(varchar(5),DATEADD(minute,ROUND(timeInDecimal * 60,0),0),108),1) not in ('0','5')
But it does hardly seems to be the ideal way to deal with this.
Feels like I can use the modulo operator for this, but how?
Or is there an even better way?
Hope for a quick answer.
Kind Regards
Andreas
Using the modulus operator, twice:
ROUND((timeInDecimal % 1) * 60, 0) % 5 <> 0
That will:
Get the fractional part and convert it to minutes.
Round it to the nearest minute (.33 hours -> 20 minutes, not 19.80).
Check whether that's divisible by 5.

CRM 2011 - Set/Retrieve work hours programmatically

I am attempting to retrieve a resources work hours to perform some logic I require. I understand that the CRM scheduling engine is a little clunky around such things, but I assumed that I would be able to find out how the working hours were stored in the DB eventually...
So a resource has associated calendars and those calendars have associated calendar rules and inner calendars etc. It is possible to look at the start/end and frequency of aforementioned calendar rules and query their codes to work out whether a resource is 'working' during a given period. However, I have not been able to find the actual working hours, the 9-5 shall we say in any field in the DB.
I even tried some SQL profiling while I was creating a new schedule for a resource via the UI, but the results don't show any work hours passing to SQL. For those with the patience the intercepted SQL statement is below:-
EXEC Sp_executesql
N'update [CalendarRuleBase] set [ModifiedBy]=#ModifiedBy0, [EffectiveIntervalEnd]=#EffectiveIntervalEnd0, [Description]=#Description0, [ModifiedOn]=#ModifiedOn0, [GroupDesignator]=#GroupDesignator0, [IsSelected]=#IsSelected0, [InnerCalendarId]=#InnerCalendarId0, [TimeZoneCode]=#TimeZoneCode0, [CalendarId]=#CalendarId0, [IsVaried]=#IsVaried0, [Rank]=#Rank0, [ModifiedOnBehalfBy]=NULL, [Duration]=#Duration0, [StartTime]=#StartTime0, [Pattern]=#Pattern0 where ([CalendarRuleId] = #CalendarRuleId0)',
N'#ModifiedBy0 uniqueidentifier,#EffectiveIntervalEnd0 datetime,#Description0 ntext,#ModifiedOn0 datetime,#GroupDesignator0 ntext,#IsSelected0 bit,#InnerCalendarId0 uniqueidentifier,#TimeZoneCode0 int,#CalendarId0 uniqueidentifier,#IsVaried0 bit,#Rank0 int,#Duration0 int,#StartTime0 datetime,#Pattern0 ntext,#CalendarRuleId0 uniqueidentifier',
#ModifiedBy0='EB04662A-5B38-E111-9889-00155D79A113',
#EffectiveIntervalEnd0='2012-01-13 00:00:00',
#Description0=N'Weekly Single Rule',
#ModifiedOn0='2012-03-12 16:02:08',
#GroupDesignator0=N'FC5769FC-4DE9-445d-8F4E-6E9869E60857',
#IsSelected0=1,
#InnerCalendarId0='3C806E79-7A49-4E8D-B97E-5ED26700EB14',
#TimeZoneCode0=85,
#CalendarId0='E48B1ABF-329F-425F-85DA-3FFCBB77F885',
#IsVaried0=0,
#Rank0=2,
#Duration0=1440,
#StartTime0='2000-01-01 00:00:00',
#Pattern0=N'FREQ=WEEKLY;INTERVAL=1;BYDAY=SU,MO,TU,WE,TH,FR,SA',
#CalendarRuleId0='0A00DFCF-7D0A-4EE3-91B3-DADFCC33781D'
The key parts in the statement are the setting of the pattern:-
#Pattern0=N'FREQ=WEEKLY;INTERVAL=1;BYDAY=SU,MO,TU,WE,TH,FR,SA'
However, as mentioned, no indication of the work hours set.
Am I thinking about this incorrectly or is CRM doing something interesting around these work hours?
Any thoughts greatly appreciated, thanks.
If you look in the CalendarRuleBase table you should see a record with the data you gathered in your trace. You should also see another record created approximately the same time and it will have a CalendarId that equals the InnerCalendarId of the data from the trace. In this record there is a value - Offset which appears to represent the number of minutes past midnight for the start time. There is another value - Duration which appears to be the number of minutes of the shift.
I created work hours from 8-5. My offset was 480 (480/60 = 8) 8 AM start time and the duration was 540 (540/60 = 9) for a 9 hour shift.

SQL repeat events by timer

I want that a column of my database, composed by float random numbers, change every x seconds determined by a timer.
I read about Schedule Tasks Events but i can't work it.
Please help
The following statement solve part of the problem, i hope it will be useful for others users:
CREATE EVENT addTimer
ON SCHEDULE EVERY 2 SECOND
STARTS CURRENT_TIMESTAMP ENDS CURRENT_TIMESTAMP + INTERVAL 9 HOUR
DO
UPDATE prova.prova SET actual = actual + 1
I'm only familiar with sql server, but could you set up a stored proc with an infinite loop and a wait?